CVE-2023-4699
Mitsubishielectric Fx3g-14mr/ds Firmware remote code execution
- Published6 Nov 2023
Description
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi Electric CNC M800V/M80V series, Mitsubishi Electric CNC M800/M80/E80 series and Mitsubishi Electric CNC M700V/M70V/E70 series allows a remote unauthenticated attacker to execute arbitrary commands by sending specific packets to the affected products. This could lead to disclose or tamper with information by reading or writing control programs, or cause a denial-of-service (DoS) condition on the products by resetting the memory contents of the products to factory settings or resetting the products remotely.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HAffected products
Remediation
No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.
Frequently asked
Is CVE-2023-4699 being actively exploited?
CVE-2023-4699 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.75%.
How severe is CVE-2023-4699?
CVE-2023-4699 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 0.75% probability of exploitation.
Which products are affected by CVE-2023-4699?
Affected products include Mitsubishielectric Fx3g-14mr/ds Firmware, Mitsubishielectric Fx3g-14mr/es-a Firmware, Mitsubishielectric Fx3g-14mr/es Firmware, Mitsubishielectric Fx3g-14mt/ds Firmware, Mitsubishielectric Fx3g-14mt/dss Firmware, and 19 more.
How do I fix CVE-2023-4699?
Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2023-4699 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.